Corporate travel management company BCD Travel was targeted by ShinyHunters during their extortion campaign in May 2026, with public data release in early June exposing approximately 396,000 unique email addresses alongside names, addresses, phone numbers, job titles, and employer names extracted from leads, internal staff records, and support tickets.